AxiLayer AI crestAxiLayerAI™
AxiLayer AI Assurance Intelligence · Our Auditors

Who Signs Our Findings, and Why You Can Trust Them

Buyers, insurers and regulators now ask who assures the assurers. Here is exactly how a qualified AxiLayer AI auditor is trained, kept impartial and held accountable for every finding they sign.

3
Academy levels before signing authority
Annual
Impartiality declaration by every auditor
3 years
Rotation flag on long engagements
12
Buyer checklist questions, answered
Free
Re-verification of any record

Last verified: 23 October 2026

Qualification

How a qualified AxiLayer AI auditor earns the right to sign

Signing authority is not something you can buy. Every qualified AxiLayer AI auditor completes the AxiLayer AI Global Academy pathway and a supervised period before signing anything, and then signs only within an approved scope.

Level 1

Foundations

How AI systems work and fail, the rules that govern them worldwide, and what a third-party assessment looks for. Online lessons, quizzes and live sessions.

Level 2

Practitioner

Audit methods in practice on the AxiSentinel™ training environment with demonstration data, ending in one graded practice assessment.

Level 3

Qualified AxiLayer AI Auditor

By invitation only. Supervised engagements, observed assessments and a competence review, leading to a contract with AxiLayer AI and signing authority within an approved scope.

Every year

Kept current

Lessons are reviewed the week a rule changes, and every auditor renews an annual impartiality declaration before signing.

Impartiality

Rules that protect every finding

  • Annual declaration: former clients in the last two years, financial interests and other relationships, recorded every year.
  • Conflict check before signing: the system blocks a sign-off if the declaration is missing, if the auditor led readiness work for that client, or if the client is a declared former client.
  • Rotation: an auditor on the same client for more than three years is flagged for rotation.
  • Separation of duties: readiness work and assessment are kept apart, and staff access is limited by region and role.
  • Appeals: decided by a different qualified AxiLayer AI auditor, never the one who confirmed the finding.

Sign-off and re-verification

Every AxiLayer AI finding is reviewed and signed by a qualified AxiLayer AI auditor. The signed record carries the scope, frameworks, result and date, and anyone can re-verify it at any time on our free Verify page.

Verify a record

Complaints and appeals: contactus@axilayerai.com

Buyer’s checklist

How to choose an AI auditor, and our answers

Twelve questions drawn from ISO/IEC 42006, the Cloud Security Alliance’s guidance on credible AI assurance providers and the UK’s third-party AI assurance roadmap. Ask them of any provider.

Question to askAxiLayer AI’s answer
Is the auditor separate from the people who built or sold the AI?Yes. An auditor who led readiness work for a client cannot audit that client, and the system blocks the assignment.
Does each auditor declare conflicts every year?Yes. Every auditor records an annual impartiality declaration covering former clients in the last two years, financial interests and other relationships. Without a current declaration, they cannot sign.
Is there rotation on long engagements?Yes. An auditor on the same client for more than three years is flagged for rotation.
Who signs the findings?A qualified AxiLayer AI auditor under contract with AxiLayer AI, with signing authority within an approved scope.
How were the auditors qualified?Through the AxiLayer AI Global Academy: Foundations, Practitioner, then supervised engagements, observed assessments and a competence review at Level 3, by invitation only.
What standards does the work follow?ISO/IEC 17020:2026 inspection-body requirements, ISO/IEC 42006 competence expectations for auditors of AI management systems, ISO/IEC 42001, ISO/IEC 23894, the NIST AI RMF and the laws that apply in each market.
Is the assessment continuous or a snapshot?Continuous where the client chooses: AxiSentinel™ evaluates AI systems Always On or On Demand, and findings stay current between scheduled reviews.
Can a finding be appealed?Yes. A client can appeal a finding, and the appeal is decided by a different qualified AxiLayer AI auditor, never the one who confirmed it. Complaints and appeals: contactus@axilayerai.com.
Can anyone check a record later?Yes. Records can be re-verified at any time on our free Verify page, without an account.
Is the evidence tamper-evident?Yes. Findings are recorded in a signed, re-verifiable evidence chain with dates and versions.
What is the accreditation status?AxiLayer AI’s ISO/IEC 17020:2026 Type A application is in process, alongside a parallel ISO/IEC 42001 application, both with a U.S.-based accreditation body signatory to the ILAC MRA and IAF MLA.
Will AxiLayer AI join public auditor registries?Yes. AxiLayer AI intends to apply to California’s AI auditor registry under AB 1405 as soon as it opens, and to similar registries as they are created.

Around the world

How AI auditors are recognized, region by region

Governments and standards bodies are building ways to recognize AI auditors and assessors, from California’s registry to accreditation against ISO/IEC 42006 and national testing schemes. This is where it stands.

United States 5

  • California AB 1405 (Chapter 178, Statutes of 2026) creates an AI Auditor Registry at the Government Operations Agency; from 1 Jan 2029 only registered auditors may offer or conduct covered AI audits, and they must meet independence rules and sign a dated audit statement. Source, 9 Sep 2026
  • California SB 813 (signed 9 Sep 2026) directs the Government Operations Agency to set criteria by 1 Jan 2028 for designating AI verification organizations that show technical competence and independence. Source, Oct 2026
  • Illinois SB 315 requires large frontier developers to retain third-party auditors with demonstrated frontier-model safety expertise and no financial conflicts for annual audits from 1 Jan 2028. Source, Jul 2026
  • NYC Local Law 144 requires bias audits by an independent auditor, which DCWP rules define as a person not involved in developing or using the tool and without a financial interest in the employer or vendor. Source, Jul 2023
  • California SB 1119 requires companion chatbot operators to obtain independent child safety audits every two years, with the first due by 1 Jan 2029 for operators with $500 million or more in revenue. Source, Oct 2026

Canada and Latin America 6

  • The Standards Council of Canada launched an Artificial Intelligence Management Systems accreditation program based on ISO/IEC 42001 on 4 March 2025, and has accredited its first certification body to certify organizations to ISO/IEC 42001. Source, 4 Mar 2025
  • CSA Group is developing CSA ISO/IEC 42006 as a National Standard of Canada, setting requirements for bodies that audit and certify AI management systems, which can serve as accreditation criteria. Source, 2026
  • OSFI Guideline E-23 lets institutions rely on internal reviewers or objective third parties for independent model review, provided review is independent of model development. Source, 11 Sep 2025
  • Under the federal Directive on Automated Decision-Making, higher-impact systems need peer review by qualified reviewers with findings published before production; the Treasury Board released a Guide to Peer Review of Automated Decision Systems on 7 January 2025. Source, Sep 2026
  • In Brazil, CNJ Resolution 615/2025 subjects high-risk judicial AI systems to regular audits, and the CNJ National AI Committee can require additional audits and set audit rules. Source, Mar 2025
  • A Mexican federal AI bill introduced in the Chamber of Deputies on 24 July 2026 proposes a National Algorithmic Audit Platform and a National AI Council; it has not been enacted. Source, 3 Aug 2026

Europe 6

  • Under the EU AI Act, conformity assessment bodies are designated by national notifying authorities as notified bodies (Articles 28 to 39); bodies already notified under Annex I Section A product legislation must apply for AI Act designation by 28 Jan 2028. Source, 24 Jul 2026
  • In Germany, KI-MIG makes the German Accreditation Body (DAkkS) responsible for assessing and monitoring conformity assessment bodies for Annex III point 1 biometric systems, with the BSI acting as interim notifying authority. Source, 22 Jul 2026
  • Notifying authorities named so far include AgID in Italy, the National Accreditation Authority in Hungary, the Innovation Agency in Lithuania, the Agency for Digital Government in Denmark and the Malta Digital Innovation Authority. Source, 17 Jun 2026
  • DSA Article 37 audits of very large online platforms must be performed by organizations independent of the provider with proven expertise, objectivity and professional ethics, following the methodology in Delegated Regulation (EU) 2024/436. Source, Feb 2024
  • The UK Trusted Third-Party AI Assurance Roadmap (3 Sep 2025) favors professionalization of AI assurance and notes that UKAS is piloting accreditation of ISO/IEC 42001 AI management system certification bodies. Source, 3 Sep 2025
  • A UK AI assurance consortium chaired by BCS is developing a voluntary code of ethics and a skills and competencies framework for AI assurance practitioners, with professional certification starting with AI auditing under consideration; no registration scheme exists yet. Source, Sep 2026

Middle East 3

  • The DIFC's 2026 consultation proposes a new Regulation 11 letting the Commissioner of Data Protection recognize accreditation and certification frameworks, and plans a separate certification for Autonomous Systems Officers. Source, 18 Jun 2026
  • The Dubai Centre for Artificial Intelligence certifies AI companies directly through the tiered Dubai AI Seal, which is a prerequisite for upcoming Dubai government AI projects. Source, 15 May 2025
  • SDAIA assesses AI service providers itself and awarded accreditation certificates to 40 entities in early 2025, alongside five-level AI ethics incentive badges valid for one year. Source, 3 Feb 2025

Africa 2

  • Egypt's framework makes the SECC, under ITIDA, the technical conformity body that conducts or oversees AI technical audits and accredits private audit firms, with a regulatory AI audit lab and sandbox planned. Source, 15 Mar 2026
  • The Central Bank of Nigeria's baseline standards for automated AML solutions require third-party annual validation of AI and machine learning models, without naming a registration scheme for validators. Source, Jun 2025

Asia 7

  • Singapore's AI Verify Foundation launched the AI Tester Accreditation Programme (AI TAP) on 14 Oct 2026 and announced its first batch of accredited third-party AI testers, assessed on technical competency, operational readiness, financial sustainability and good standing. Source, 14 Oct 2026
  • Singapore's Global AI Assurance Sandbox maintains a panel of technical testing firms that must offer AI testing as a service and show expertise in benchmarking, red-teaming or automated evaluation. Source, 9 Sep 2026
  • Vietnam's AI Law and Decree 142/2026/ND-CP require certain designated high-risk AI systems to be assessed by registered or recognized conformity assessment organizations before deployment, while other high-risk systems may be self-assessed or assessed by such bodies. Source, May 2026
  • Kazakhstan's AI law ties inclusion on the list of trusted AI systems to an audit by specialized private auditors under audit rules set by a 2018 ministerial order (No. 263). Source, 9 Dec 2025
  • China's AI ethics review measures (March 2026) let authorities set up AI technology ethics review and service centers at qualified institutions to review activities for entities without their own committee, and the anthropomorphic AI measures allow minors' data compliance audits by a qualified third party. Source, 9 Apr 2026
  • Taiwan's AI Basic Act directs the Ministry of Digital Affairs and other agencies to provide or recommend AI assessment and verification tools or methods, developed in consultation with industry, academia and civil society. Source, Jan 2026
  • India's RBI draft model risk management guidance (June 2026) requires independent validation of all models, including third-party AI models, regardless of any vendor certification. Source, 24 Jun 2026

Oceania 4

  • JAS-ANZ, the joint accreditation body for Australia and New Zealand, accredits certification bodies for ISO/IEC 42001 AI management systems; Intertek announced global JAS-ANZ accreditation for ISO/IEC 42001 certification on 30 July 2025. Source, 30 Jul 2025
  • Standards Australia adopted ISO/IEC 42001 as AS ISO/IEC 42001:2023 in February 2024, giving Australian organizations a national version of the AI management system standard. Source, 16 Feb 2024
  • NATA, which accredits Australian inspection bodies, is running a three-year transition to ISO/IEC 17020:2026 ending around March 2029, with assessments against the new edition starting six months after the AS/NZS version is published. Source, 9 Jun 2026
  • None of the Australian or New Zealand AI instruments reviewed here register or license AI auditors: assessments under the Commonwealth AI policy, NSW framework, Privacy Act and NZ biometrics code are performed by the organization itself, and the administering agency for the proposed national AI Standards has not been decided. Source, 17 Sep 2026

Global standards and schemes 7

  • ISO/IEC 42006:2025, published in July 2025, sets the requirements that certification bodies must meet to audit and certify ISO/IEC 42001 AI management systems, building on ISO/IEC 17021-1, and is used by accreditation bodies to assess those certification bodies. Source, Jul 2025
  • Accreditation bodies are already accrediting ISO/IEC 42001 certification bodies; for example JAS-ANZ accredited Intertek on 30 July 2025 to certify organizations worldwide to ISO/IEC 42001. Source, 30 Jul 2025
  • Inspection bodies that assess AI systems are accredited under ISO/IEC 17020; the 2026 edition was published on 27 March 2026 with an internationally agreed three-year transition, and UKAS accepts new applications only to the 2026 edition from 1 September 2026. Source, 30 Mar 2026
  • Singapore's IMDA and AI Verify Foundation run a Global AI Assurance Sandbox, which grew out of a 2025 pilot, that matches generative AI deployers with a panel of specialist technical testing firms assessed on their benchmarking, red-teaming and evaluation expertise, and the Foundation lists an AI Tester Accreditation Programme. Source, Oct 2026
  • CSA STAR for AI Level 2, available from 20 November 2025, recognizes providers that combine a Valid-AI-ted AI-CAIQ with an ISO/IEC 42001 certification, linking an industry registry to accredited management system certification. Source, 20 Nov 2025
  • Government AI testing bodies coordinate through the International Network for Advanced AI Measurement, Evaluation and Science (renamed in December 2025), whose members include institutes from Australia, Canada, the EU, France, Japan, Kenya, Korea, Singapore, the UK and the US and which has published consensus guidance on automated evaluation practices. Source, 16 Oct 2026
  • The Cloud Security Alliance (Sep 2026) lists signs of a credible AI assurance provider: verifiable accreditation, auditor competence aligned with ISO/IEC 42006, a genuine third-party audit rather than self-assessment, and periodic reassessment. Source, Sep 2026
Questions

Frequently asked questions

How do I choose an AI auditor?

Ask whether the auditor is separate from those who built the AI, declares conflicts every year, rotates on long engagements, is qualified against standards such as ISO/IEC 42006, signs findings personally, offers appeals, and lets you re-verify records. Our twelve-question checklist on this page gives AxiLayer AI’s answer to each.

Who signs AxiLayer AI findings?

Every finding is reviewed and signed by a qualified AxiLayer AI auditor under contract with AxiLayer AI, with signing authority within an approved scope, after an annual impartiality declaration and a conflict check.

What is ISO/IEC 42006?

ISO/IEC 42006:2025 sets requirements for bodies that audit and certify AI management systems under ISO/IEC 42001, including AI-specific auditor competence. National accreditation bodies are adopting it during 2026.

Is there a registry of AI auditors?

California enacted AB 1405 in September 2026 to create a state registry of AI auditors, alongside SB 813 on verification organizations. AxiLayer AI intends to apply as soon as the registry opens.

Can I become a qualified AxiLayer AI auditor?

Yes, through the AxiLayer AI Global Academy. Levels 1 and 2 are open courses, and strong Level 2 graduates may be invited to Level 3, which leads through supervised engagements and a competence review to a contract with AxiLayer AI.